Why is my site being redirected to the AWPG Education Page?

The APWG/CMU Phishing Education Landing Page is hosted by the APWG to provide guidance regarding phishing, a common scam. The page is designed to educate users and help them avoid fraud and Identity Theft. Your ISP (or host which controls your website) has redirected traffic to it because a page on your website was identified as hosting phishing content. The APWG has no control over the redirect, nor access required to actuate a redirect or remove it. The most immediate path to restoration of your website is to contact your hosting ISP or service.

But my website is legal and legitimate, how did a phishing page get on there?

There are myriad ways a website can be compromised. One common way of gaining illicit access to websites involve exploiting known vulnerabilities in software being used, such as online store software. Perpetrators “crack” your password, or use more technical approaches.

How were the perpetrators able to erect a phishing page without my knowledge?

Once the perpetrators gain access to a web server, they typically leave the legitimate content alone, and bury phishing pages several directories deep to avoid detection by Webmasters.

What can I do to solve this problem/prevent this from happening again?

Change your password. Now. Secure passwords include upper- and lower-case letters, numbers and symbols, and avoid dictionary words. Avoid mnemonics like birthdays and family names. Contact your ISP to reset your password, if you are locked out of your website.

How should I clean up the mess left by the bad guys?

Ask your ISP or hosting service for the URL location of the phish site to speed removal and remediation. Administrators can consult the APWG advisory What to Do if Your Website Has Been Hacked by Phishers for detailed advice on remediating server technology that has been co-opted in a phishing attack. That advisory is available here: http://www.antiphishing.org/reports/APWG_WTD_HackedWebsite.pdf

If you use third-party software, visit the developer’s website to locate security updates and patches. These applications often lack automated updating. Contact your ISP and consider their recommendations for securing your website. Alternatively, third-party security vendors can analyze your site and provide you with a report of the potential holes in its security. Regularly check the traffic volumes on your site – there are many free tools which provide this reporting functionality – and watch for any spikes in traffic, which may be indicative of malicious content.

For more information on the APWG, visit www.apwg.org